SecuriTricks - nation-state

Kazuar: Anatomy of a nation-state botnet

Kazuar is a sophisticated malware attributed to Russian state actor Secret Blizzard, having evolved from a traditional backdoor into a highly modular peer-to-peer botnet ecosystem. The malware comprises three distinct module types—Kernel, Bridge, and Worker—that distribute functionality across infe…

espionage

nation-state

Published: May 14, 2026

Downloadable IOCs: 4

APT Group Expands Toolset With New GoGra Linux Backdoor

The Harvester APT group has developed a highly-evasive Linux version of its GoGra backdoor that leverages Microsoft Graph API and Outlook mailboxes as a covert command-and-control channel to bypass traditional network defenses. Initial VirusTotal submissions originated from India and Afghanistan, i…

Published: April 22, 2026

Downloadable IOCs: 5

Suspected Nation-State Threat Actor Uses New Airstalk Malware in a Supply Chain Attack

A new Windows-based malware family called Airstalk has been discovered, available in PowerShell and .NET variants. It is believed to be used by a nation-state threat actor in a supply chain attack. Airstalk misuses the AirWatch API for mobile device management to establish covert command-and-contro…

Published: October 29, 2025

Downloadable IOCs: 6

SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea

BlackBerry's researchers have uncovered a new campaign by the nation-state threat actor SideWinder. The group employs sophisticated techniques, such as utilizing carefully crafted phishing emails with visual lures designed to target specific organizations. The campaign aims to compromise ports and …

Published: July 30, 2024

Linked vulnerabilities : CVE-2017-11882, CVE-2017-0199

Downloadable IOCs: 47

Discovers Multiyear Sophisticated Chinese DNS Operation

This report unveils a previously undisclosed multiyear operation conducted by a sophisticated actor called Muddling Meerkat. The operation employs Domain Name System (DNS) queries, open DNS resolvers, and interacts with China's Great Firewall. The tactics demonstrate the actor's ability to conduct …

Published: April 29, 2024

Downloadable IOCs: 10

Tag: nation-state

Attack reports

Kazuar: Anatomy of a nation-state botnet

APT Group Expands Toolset With New GoGra Linux Backdoor

Suspected Nation-State Threat Actor Uses New Airstalk Malware in a Supply Chain Attack

SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea

Discovers Multiyear Sophisticated Chinese DNS Operation